-4

Trying to get to the bottom of the below SQL Error Log Message:

Logon failed for user 'sa'. Reason: Password did not match the login provided. [CLIENT: 172.16.30.227]
Error 18456, Severity 14, State 8
Event 3221243928

There wasn't much in terms of details in the log and wanted to make sure that there wasn't anything critical failing.

Thx in advance.

Improve this question
0

2 Answers 2

Reset to default
1

The error simply states that somebody/something is trying to connect to SQL Server from IP address 172.16.30.227 using the sa account but using a wrong password.

SQL Server just rejected the connection and as far as SQL Server is concerned that is the end of it.

You won't find more information in the SQL Server logs that can help you find out who or what is trying to open that connection.

You can try logging on to the 172.16.30.227 machine and check scheduled tasks or the event log in hopes of finding an indication about what is failing there.

If it's an IP address you know (such as the server itself) it could be a script or a tool that has been scheduled before the sa password was changed or it could be something that was never configured right in the first place.

If it's an IP address you don't know, or is a workstation in your network somewhere it could be a malicious user trying to log on.

The only thing you can try to determine from SQL Server logs apart from the ip address is if there is a repetition pattern in the day or time of the error.

Improve this answer
0
0

My first question to myself would be, does the IP in the error correspond to a known SQL server or application server IP address? Or a known IP of a DBA's personal computer? If not then it probably means someone who is not supposed to is trying to log into your SQL server. Might even be a hack attempt if it's someone from an authorized computer/server.

Improve this answer
4
  • The ip address is the local host, the server itself. So I am guessing it is some job or process trying to log in on the server but the log only gave those details. I am able to log into SQL Management Studio with sa/password fine. No other errors I can see.
    – Rykoff Sexton
    Dec 13, 2018 at 14:18
  • State 8 is a password mismatch. Is it possible there is a new linked server or new replication publication/subscription?
    – Alen
    Dec 13, 2018 at 14:24
  • That is what I am trying to figure out. My confusion is that I thought that if it were the linked server trying to make the login attempt that that server IP address would be listed? Thanks for all your help.
    – Rykoff Sexton
    Dec 13, 2018 at 14:34
  • I'm 99% sure i've seen this at my previous job where we had lots of linked servers using the sa account. I didn't set them up this way and had no say so in the matter. You'll probably have to run a profiler trace or extended events session to capture the exact event causing this. In my case it was a once a day process that took me a few days to catch.
    – Alen
    Dec 13, 2018 at 14:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.